The mount chain (StrictMode → QueryClientProvider → RemoteAuthGate → App) had
no error boundary above App. App's per-tab <ErrorBoundary> wraps only cover
their own subtrees, so a throw in App's own render — its top-level hooks, store
access, restoreProjectExtras, or the header/sidebar chrome that renders before
any tab — escaped every boundary and left #root empty. The shell's blank_guard
could then only reload three times and paint a dead-end failure page: exactly
the "#root children = 0 after 3 reloads" a user hit.
Wrap the mount root in <ErrorBoundary name="app-root"> so such a throw shows the
in-app, recoverable error card (Reload / Report, data untouched) instead of a
blank window. The shell guard stays as the last resort for the rarer case where
even the boundary can't render.
Recurrence-proofing (the throw only had to happen once to blank the app, and the
#1178-class variant only bites the MINIFIED bundle that dev + jsdom never run):
- main-app.test.jsx: fail-before/pass-after — a throwing app tree must leave
#root non-empty (the recovery card), not blank.
- Wire the existing production-bundle smoke (e2e-prod/prod-bundle-smoke.spec.ts)
into CI so a pre-render crash in the shipped bytes fails the pipeline, not a
user's launch. Fixed its IGNORABLE list to treat the no-backend WebSocket
handshake error as the harness artifact it is.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
